3 ms·

This is my main worry with Firefox as well. How can I even be confident beyond reasonable doubt that the uBlock Origin extension I have installed won't suddenl

This is my main worry with Firefox as well. How can I even be confident beyond reasonable doubt that the uBlock Origin extension I have installed won't suddenly start exfiltrating any passwords I enter on websites, for example.

bakugo 4y ago
>How can I even be confident beyond reasonable doubt that the uBlock Origin extension I have installed won't suddenly start exfiltrating any passwords I enter on websites, for example. You can't, just like you can't be confident that any other piece of software on your computer won't start doing it. This problem isn't specific to extensions in any way and I don't understand why people act like it is. If the risks are too much for you, don't install them, just like you wouldn't install any other software you don't trust. Don't try to ruin it for other people who understand and are willing to take the risk.
- quectophoton 4y ago
  Please try not to extrapolate my comments to conclusions like I'm (quote) trying to ruin it. Keywords are "beyond reasonable doubt". uBO is a Recommended Extension, and even has a badge that says it's only granted to extensions that meet their standards of security. But do we know if Firefox manually reviews updates as well, for changes in their source code? Or do they only review them once (at the moment where they grant that badge)? I can't find conclusive info on that front. I would be happy to know that a few extensions get their updates manually reviewed.
emaro 4y ago
You cannot. Not with any software you didn't write or very carefully review. It's always about trust. In the case of your example, I think gorhill is a prime example of a trustworthy author. He has a very good track record, never betrayed the users, explains his thought process and behaved consistently in the users (my) interest in the past. uBlock Origin is the one extension I trust the most, even more than say the Multi Container extension from Mozilla.
- quectophoton 4y ago
  My worry is not the author or the extension; it's someone being able to push a new release of the extension (e.g. signing keys compromised, some vulnerability somewhere, etc), and it being automatically approved by Firefox without manual review.
YoshiRulz 4y ago
Like all software: disable automatic updates, build from source, and vet patches when you pull them. I can't be bothered doing that, but then I'm willing to take the maintainer at their word when they say their software doesn't just have a Free license, but also respects my freedoms. https://github.com/gorhill/uBlock/wiki/Can-you-trust-uBlock-Origin%3F https://github.com/gorhill/uBlock/wiki/Can-you-trust-uBlock-...

bakugo 4y ago

>How can I even be confident beyond reasonable doubt that the uBlock Origin extension I have installed won't suddenly start exfiltrating any passwords I enter on websites, for example. You can't, just like you can't be confident that any other piece of software on your computer won't start doing it. This problem isn't specific to extensions in any way and I don't understand why people act like it is. If the risks are too much for you, don't install them, just like you wouldn't install any other software you don't trust. Don't try to ruin it for other people who understand and are willing to take the risk.

quectophoton 4y ago
Please try not to extrapolate my comments to conclusions like I'm (quote) trying to ruin it. Keywords are "beyond reasonable doubt". uBO is a Recommended Extension, and even has a badge that says it's only granted to extensions that meet their standards of security. But do we know if Firefox manually reviews updates as well, for changes in their source code? Or do they only review them once (at the moment where they grant that badge)? I can't find conclusive info on that front. I would be happy to know that a few extensions get their updates manually reviewed.

emaro 4y ago

You cannot. Not with any software you didn't write or very carefully review. It's always about trust. In the case of your example, I think gorhill is a prime example of a trustworthy author. He has a very good track record, never betrayed the users, explains his thought process and behaved consistently in the users (my) interest in the past. uBlock Origin is the one extension I trust the most, even more than say the Multi Container extension from Mozilla.

quectophoton 4y ago
My worry is not the author or the extension; it's someone being able to push a new release of the extension (e.g. signing keys compromised, some vulnerability somewhere, etc), and it being automatically approved by Firefox without manual review.

YoshiRulz 4y ago

Like all software: disable automatic updates, build from source, and vet patches when you pull them. I can't be bothered doing that, but then I'm willing to take the maintainer at their word when they say their software doesn't just have a Free license, but also respects my freedoms. https://github.com/gorhill/uBlock/wiki/Can-you-trust-uBlock-Origin%3F https://github.com/gorhill/uBlock/wiki/Can-you-trust-uBlock-...